#!/bin/bash

# 配置项
EXCLUDE_DIRS=(
)
SUSPICIOUS_DIR="/tmp/suspicious_files"
LOG_FILE="/tmp/scan_history.log"
WEBSITE_DIRS=(
)
DINGTALK_WEBHOOK=""
HIGH_RISK_DOMAINS=(

    "jsc20244.com"
    "jschl.nn02.cc"
)
PHP_FILES_LIST="/tmp/php_files_list.txt"
WEBSITE_LIST="/tmp/website_list.txt"

send_dingtalk_notification() {
    local message="$1"
    echo "$(date +%Y-%m-%d\ %H:%M:%S) - $message" >> "$LOG_FILE"
    curl -H "Content-Type: application/json" -X POST -d "{\"msgtype\": \"text\", \"text\": {\"content\": \"$message\"}}" "$DINGTALK_WEBHOOK"
}

scan_php_files() {
    local website_dir="$1"
    local exclude_args=()
    
    for exclude_dir in "${EXCLUDE_DIRS[@]}"; do
        exclude_args+=(-path "$exclude_dir" -prune -o)
    done

    find "$website_dir" "${exclude_args[@]}" -type f -name "*.php" -print | while read -r file; do
        for domain in "${HIGH_RISK_DOMAINS[@]}"; do
            if grep -q "$domain" "$file"; then
                local message=$(printf "高风险警告：在文件 %s 中发现可疑域名：%s\n已从文件中移除包含 %s 的行" "$file" "$domain" "$domain")
                echo "$message"
                send_dingtalk_notification "$message"
                
                mkdir -p "$SUSPICIOUS_DIR"
                cp "$file" "$SUSPICIOUS_DIR/$(basename "$file")_$(date +%Y%m%d%H%M%S)"
                
                sed -i "/$domain/d" "$file"
            fi
        done
    done
}

update_php_files_list() {
    local is_new_website="$1"
    local temp_list=$(mktemp)
    local exclude_args=()
    
    for exclude_dir in "${EXCLUDE_DIRS[@]}"; do
        exclude_args+=(-path "$exclude_dir" -prune -o)
    done

    for dir in "${WEBSITE_DIRS[@]}"; do
        find "$dir" "${exclude_args[@]}" -name "*.php" -print >> "$temp_list"
    done
    sort -u -o "$temp_list" "$temp_list"

    if [ ! -f "$PHP_FILES_LIST" ]; then
        mv "$temp_list" "$PHP_FILES_LIST"
        echo "初始PHP文件列表已创建。"
    else
        new_files=$(comm -13 "$PHP_FILES_LIST" "$temp_list")
        if [ -n "$new_files" ]; then
            if [ "$is_new_website" != "true" ]; then
                echo "发现新增的PHP文件："
                echo "$new_files"
                
                while IFS= read -r file; do
                    if [ -f "$file" ]; then
                        mkdir -p "$SUSPICIOUS_DIR"
                        cp "$file" "$SUSPICIOUS_DIR/$(basename "$file")_$(date +%Y%m%d%H%M%S)"
                        
                        echo "删除新增PHP文件: $file"
                        rm -f "$file"
                        local message=$(printf "警告：发现新增的PHP文件：%s\n已删除新增PHP文件 %s" "$file" "$file")
                        send_dingtalk_notification "$message"
                    fi
                done <<< "$new_files"
            else
                echo "检测到新网站,不删除新增的PHP文件。"
            fi
        fi
        mv "$temp_list" "$PHP_FILES_LIST"
    fi
}

check_new_websites() {
    if [ ! -f "$WEBSITE_LIST" ]; then
        printf "%s\n" "${WEBSITE_DIRS[@]}" | sort > "$WEBSITE_LIST"
        echo "初始网站列表已创建。"
        update_php_files_list "true"
    else
        local old_websites
        old_websites=$(cat "$WEBSITE_LIST")
        local new_websites
        new_websites=$(printf "%s\n" "${WEBSITE_DIRS[@]}" | sort)
        
        if [ "$old_websites" != "$new_websites" ]; then
            echo "检测到网站列表变化，更新PHP文件列表。"
            printf "%s\n" "${WEBSITE_DIRS[@]}" | sort > "$WEBSITE_LIST"
            update_php_files_list "true"
        fi
    fi
}

main() {
    if [ "$1" = "update" ]; then
        check_new_websites
        update_php_files_list "true"
        exit 0
    fi

    check_new_websites

    for website_dir in "${WEBSITE_DIRS[@]}"; do
        echo "开始扫描 $website_dir 中的PHP文件..."
        scan_php_files "$website_dir"
    done

    update_php_files_list "false"
    echo "扫描完成。"
}

main "$@"